diff --git a/native/src/core/bootstages.cpp b/native/src/core/bootstages.cpp
index 19586bf34..6a2ea6126 100644
--- a/native/src/core/bootstages.cpp
+++ b/native/src/core/bootstages.cpp
@@ -73,7 +73,7 @@ static void setup_mounts() {
     // Prepare worker
     ssprintf(path, sizeof(path), "%s/" WORKERDIR, get_magisk_tmp());
     xmkdir(path, 0);
-    xmount("worker", path, "tmpfs", 0, "mode=755");
+    xmount(path, path, nullptr, MS_BIND, nullptr);
     xmount(nullptr, path, nullptr, MS_PRIVATE, nullptr);
 }
 
diff --git a/native/src/core/deny/revert.cpp b/native/src/core/deny/revert.cpp
index 90dd206ca..e6c56ebd2 100644
--- a/native/src/core/deny/revert.cpp
+++ b/native/src/core/deny/revert.cpp
@@ -20,7 +20,7 @@ void revert_unmount() {
     // Unmount dummy skeletons and MAGISKTMP
     // since mirror nodes are always mounted under skeleton, we don't have to specifically unmount
     for (auto &info: parse_mount_info("self")) {
-        if (info.source == "magisk" || info.source == "worker" || // magisktmp tmpfs
+        if (info.source == "magisk" || // magisktmp tmpfs
             info.root.starts_with("/adb/modules")) { // bind mount from data partition
             targets.insert(info.target);
         }
diff --git a/native/src/core/module.cpp b/native/src/core/module.cpp
index 64c9328c1..6b3b750dc 100644
--- a/native/src/core/module.cpp
+++ b/native/src/core/module.cpp
@@ -162,6 +162,7 @@ void tmpfs_node::mount() {
         dir_node::mount();
         VLOGD(replace() ? "replace" : "move", worker_dir.data(), node_path().data());
         xmount(worker_dir.data(), node_path().data(), nullptr, MS_MOVE, nullptr);
+        xmount(nullptr, node_path().data(), nullptr, MS_REMOUNT | MS_BIND | MS_RDONLY, nullptr);
     } else {
         const string dest = worker_path();
         // We don't need another layer of tmpfs if parent is tmpfs
@@ -326,8 +327,11 @@ void load_modules() {
         root->mount();
     }
 
+    // cleanup mounts
     ssprintf(buf, sizeof(buf), "%s/" WORKERDIR, get_magisk_tmp());
-    xmount(nullptr, buf, nullptr, MS_REMOUNT | MS_RDONLY, nullptr);
+    xumount2(buf, MNT_DETACH);
+    ssprintf(buf, sizeof(buf), "%s/" MODULEMNT, get_magisk_tmp());
+    xumount2(buf, MNT_DETACH);
 }
 
 /************************